From d3e6b9250fbca697573371d95e9e3cd9bbd5e9d7 Mon Sep 17 00:00:00 2001 From: MeepMr <67143880+MeepMr@users.noreply.github.com> Date: Mon, 14 Sep 2026 16:58:35 +0200 Subject: [PATCH] probe round 3: keep the failed k3s node and dump its log --- .github/workflows/renovate.yml | 108 ++++++++++++++++++++++++++ .github/workflows/validate-charts.yml | 13 +++- 2 files changed, 120 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/renovate.yml diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml new file mode 100644 index 0000000..2d967f0 --- /dev/null +++ b/.github/workflows/renovate.yml @@ -0,0 +1,108 @@ +# Renovate, self-hosted (issue #225). +# +# On github.com Renovate arrived as the `jlab-renovate` GitHub App and this +# repo only ever carried renovate.json5. Gitea has no app model and no hosted +# Renovate, so after the move the bot has to be *run* by this repo: a scheduled +# job with its own token. That is the only change to how dependencies are +# updated - renovate.json5 stays the single source of what gets updated, and +# everything in it works unchanged on the Gitea platform. +# +# What the maintainer has to create once on the instance (the token this +# workflow cannot create for itself): +# +# RENOVATE_TOKEN Gitea access token of the bot account, scopes +# read:user, write:issue, write:repository. Renovate opens +# the PRs and the dependency dashboard issue with it, so +# the PRs will be authored by whoever owns the token. +# GITHUB_COM_TOKEN Read-only github.com PAT (public_repo / no scopes at all +# is enough). NOT optional here: every `github-releases` and +# `github-tags` lookup in renovate.json5 - and the whole +# built-in github-actions manager, which resolves +# actions/checkout and friends on github.com - hits +# github.com's unauthenticated rate limit within one run +# otherwise. On the App this came for free; here it does not. +# README already names this for the `no-result` symptom. +# +# There is deliberately no `allowedCommands` to set up by hand any more: the +# postUpgradeTasks hook renovate.json5 needs (ci/renovate-bump-chart.sh, which +# recomputes `version:` after an appVersion change) is allow-listed by the +# RENOVATE_ALLOWED_COMMANDS env below, because this workflow *is* the instance +# config now. Without it Renovate skips the task silently and every chart PR +# stays red on the version-bump check - see README, "The version-bump hook". +name: Renovate + +on: + schedule: + # 03:40 UTC, once a day. Renovate's own `timezone` in renovate.json5 + # (Europe/Berlin) governs the PR schedules; this cron is plain UTC. + - cron: "40 3 * * *" + workflow_dispatch: + inputs: + dryRun: + description: "Dry run: 'full' looks up and renders everything but writes nothing" + type: choice + default: "full" + options: ["full", "lookup", "extract", "disabled"] + logLevel: + description: "Renovate log level" + type: choice + default: "info" + options: ["info", "debug"] + +jobs: + renovate: + name: Renovate + # The guard that keeps this workflow inert on github.com. The file reaches + # GitHub as well (that is where the migration PR is merged), and a + # scheduled run there would authenticate a *Gitea* token against a Gitea + # endpoint from a runner that has neither - failing nightly for a reason + # nobody is watching for. GITHUB_SERVER_URL is the one context value that + # differs between the two platforms without naming our instance: Gitea + # sets it to its own base URL. Delete this line once github.com is a + # push mirror without Actions. + if: github.server_url != 'https://github.com' + # No Docker socket needed: the Gitea runner starts every job in a container + # itself, and `container:` is the runner's job to create, not the job's. + # Measured on the probe PR of #225 - the same distinction that puts + # install-test on ubuntu-docker leaves this job on ubuntu-latest. + runs-on: ubuntu-latest + # The official image rather than `npx renovate`: it ships the git, node and + # package-manager versions Renovate expects, and pulling ~200 MB from npm + # on every scheduled run is the alternative. Renovate's built-in + # github-actions manager keeps this tag current (proved by dry run, see the + # migration PR) - it reads `container:` images, not only `uses:`. + container: ghcr.io/renovatebot/renovate:44.87.1 + steps: + - name: "Checkout Repository" + uses: actions/checkout@v7 + + - name: "Run Renovate" + env: + # Platform. The endpoint is derived from the run itself so the + # instance address stays out of this repository, the same rule the + # publish workflow follows for the registry URL. + RENOVATE_PLATFORM: gitea + RENOVATE_ENDPOINT: ${{ github.server_url }}/api/v1 + RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} + GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }} + + # Exactly this repository. Autodiscovery would enrol every repo the + # token can see, and the token is an account token, not an app + # installation scoped to one repo. + RENOVATE_AUTODISCOVER: "false" + RENOVATE_REPOSITORIES: ${{ github.repository }} + + # Who the commits are by. The e-mail must not be a real address of a + # person - Gitea attributes a commit to the account whose verified + # address matches, and these commits are the bot's. + RENOVATE_GIT_AUTHOR: "Renovate Bot " + + # The instance-level half of renovate.json5's postUpgradeTasks. A + # command not listed here is skipped WITHOUT an error message. + RENOVATE_ALLOWED_COMMANDS: '["^ci/renovate-bump-chart\\.sh"]' + + # Manual runs default to a dry run; the schedule is the only thing + # that writes on its own. + RENOVATE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dryRun || 'null' }} + LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && inputs.logLevel || 'info' }} + run: renovate diff --git a/.github/workflows/validate-charts.yml b/.github/workflows/validate-charts.yml index 2888819..f7db6e9 100644 --- a/.github/workflows/validate-charts.yml +++ b/.github/workflows/validate-charts.yml @@ -335,7 +335,18 @@ jobs: - name: "Install k3d" run: curl -sSfL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG="$K3D_VERSION" bash - name: "Create k3d cluster" - run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s + run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s --no-rollback + - name: "PROBE why did k3s not come up (remove before merge)" + if: failure() + run: | + docker ps -a + echo "=== docker logs k3d-install-test-server-0 ===" + docker logs k3d-install-test-server-0 2>&1 | tail -100 || true + echo "=== docker info ===" + docker info || true + echo "=== host cgroup ===" + cat /proc/self/cgroup || true + ls /sys/fs/cgroup | head -30 || true # Every chart reaching this step is one the exclusion filter let through, # so the script's SKIP branch is never taken here - it exists for local # runs. The variables below are empty for every chart but the one that